- How do I install joselfonseca/lighthouse-graphql-passport-auth with Composer?
- Run composer require joselfonseca/lighthouse-graphql-passport-auth, then publish the package config and GraphQL schema files using the provided vendor:publish tags. Laravel Passport must already be installed and its migrations run, since the package issues tokens through Passport's OAuth2 flows. After publishing, import the package schema and types into your Lighthouse root schema and expose the mutations you need. Check Composer constraints before installing, because each major of this package tracks a Passport major.
- Which Laravel, Lighthouse, and Passport versions does version 11.0.0 require?
- Version 11.0.0's only documented change is Passport 13 support, so it targets the Laravel and PHP versions that Passport 13 supports, paired with a current Lighthouse release. The changelog does not publish an explicit compatibility matrix, so diff composer.json at the 10.0.4 and 11.0.0 tags and run composer why-not against your lockfile. If you are still on Passport 12 or Lighthouse 5.x, stay pinned to 10.0.4 until you plan the wider framework upgrade.
- How do I expose the register and login mutations in my Lighthouse schema?
- Publish the package's GraphQL schema and type definitions, then reference them from your root schema using Lighthouse schema imports or the @import directive. The package ships the mutation definitions and input types, so you only need to wire them into your root Query and Mutation types. Run php artisan lighthouse:print-schema afterwards to confirm the fields appear as expected.
- How do I customize the guard or the fields returned by the login mutation?
- The package exposes configuration for guards and token handling, so publish the config file and adjust which guard Passport authenticates against. Customize the response by extending or overriding the shipped mutation resolvers and schema types inside your own application. Re-print and diff the schema after changes to confirm the API contract stays stable for clients.
- Does this package support refresh tokens and logout?
- Yes, it ships refresh and logout mutations alongside login, so clients can rotate access tokens and revoke them without writing custom resolvers. Refresh behavior is handled by Passport's OAuth2 flows, so token TTLs and revocation semantics follow your Passport configuration. Passport 13 reshaped parts of those flows, so re-test refresh and logout after any upgrade.
- How do I test these GraphQL authentication mutations in Laravel?
- Write feature tests that post GraphQL operations to your Lighthouse endpoint and assert on the JSON response, using Laravel's database testing traits to reset state between runs. Cover register, login, refresh, logout, forgot password, and reset password, plus any social login path you expose. Because token issuance depends on Passport clients, create the password grant client in your test setup before asserting on tokens.
- Does it support forgot password, reset password, and social login?
- The package includes mutations for forgot and reset password flows as well as social login, alongside the core register, login, refresh, and logout set. Password reset relies on Laravel's password broker, so configure your mailer and password reset table as you would in a standard Laravel app. Social login depends on the provider configuration you add, so verify mutation signatures against the published schema.
- Is upgrading from 10.0.4 to 11.0.0 a breaking change?
- 11.0.0 is a major bump whose only documented change is Passport 13 support, which by semver convention signals possible breaking changes that the changelog does not spell out. Likely break points are raised PHP, Laravel, Lighthouse, and Passport constraints, dropped Passport 12 support, and possible config key or input type changes. Diff the src/ and graphql/ trees between tags, upgrade Passport to 13 in isolation first, and diff php artisan lighthouse:print-schema output before and after.
- Should I use this package or Laravel Sanctum for GraphQL authentication?
- This package is purpose-built for Lighthouse APIs authenticating through Passport's OAuth2 token flows, including refresh tokens and password grants. If you only need simple first-party SPA or mobile tokens, Sanctum with a small custom Lighthouse mutation carries much less machinery. The package does not abstract over auth strategies, so it is a poor fit if you are not already committed to Lighthouse plus Passport.
- Is joselfonseca/lighthouse-graphql-passport-auth actively maintained?
- It is a single-maintainer package whose releases are event-driven, typically bumping when Laravel Passport ships a new major version. That means upgrades are forced by the ecosystem rather than scheduled on your own timeline, so pin versions and plan upgrades alongside your Passport upgrade. Recent releases have included first-time contributor work, which is healthy but worth validating with schema diffs rather than trusting the changelog alone.